Loop Analysis in KeY Tobias Gedell gedell@cs.chalmers.se 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 1/29
Introduction There are currently two ways of handling loops in KeY: ⊲ Symbolic execution - repeated unwinding of loops Can be performed automatically by the system, but time consuming and not always possible. ⊲ Induction Hard to use and cannot automatically be applied by the system. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 2/29
Symbolic execution - drawbacks Example: for(int i = 0; i < a.length; i++) a[i] = i; ⊲ Time consuming: If a.length is large than we need to execute the loop many times. ⊲ Not possible: If a.length is unknown we do not know when to stop. We want to do better! 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 3/29
Symbolic execution - how it works for(int i = 0; i < a.length; i++) a[i] = i; ... 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 4/29
Symbolic execution - how it works for(int i = 0; i < a.length; i++) a[i] = i; ... � {a[0] := 0} for(int i = 1; i < a.length; i++) a[i] = i; ... 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 5/29
Symbolic execution - how it works for(int i = 0; i < a.length; i++) a[i] = i; ... � {a[0] := 0} for(int i = 1; i < a.length; i++) a[i] = i; ... � {a[0] := 0, a[1] := 1} for(int i = 2; i < a.length; i++) a[i] = i; ... 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 6/29
Symbolic execution - how it works for(int i = 0; i < a.length; i++) a[i] = i; ... � {a[0] := 0} for(int i = 1; i < a.length; i++) a[i] = i; ... � {a[0] := 0, a[1] := 1} for(int i = 2; i < a.length; i++) a[i] = i; ... � {a[0] := 0, a[1] := 1, a[2] := 2, . . . } ... 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 7/29
Symbolic execution - how it works for(int i = 0; i < a.length; i++) a[i] = i; ... � {a[0] := 0} for(int i = 1; i < a.length; i++) a[i] = i; ... � {a[0] := 0, a[1] := 1} for(int i = 2; i < a.length; i++) a[i] = i; ... � {a[0] := 0, a[1] := 1, a[2] := 2, . . . } ... We iteratively construct the update describing all side-effects of the loop. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 8/29
Symbolic execution - how it works For this example the update could have been constructed in a much more direct way! We can see that for each iteration of the loop the update {a[I] := I} will be added. We also know that these updates do not clash with each other. We can, therefore, skip the execution of the loop and instead directly construct the update: {∀ I ∈ [0 , a.length − 1] . a [ I ] := I, i := a.length } 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 9/29
Loop Analysis - the idea The idea behind the new treatment of loops is that we systematically: 1. Calculate the update of the loop body and abstract over the value of the loop variable, {a[I] := I} 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 10/29
Loop Analysis - the idea The idea behind the new treatment of loops is that we systematically: 1. Calculate the update of the loop body and abstract over the value of the loop variable, {a[I] := I} 2. calculate the range of the loop variable, [0, a.length - 1] 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 11/29
Loop Analysis - the idea The idea behind the new treatment of loops is that we systematically: 1. Calculate the update of the loop body and abstract over the value of the loop variable, {a[I] := I} 2. calculate the range of the loop variable, [0, a.length - 1] 3. make sure that some properties are fulfilled by the loop, For example no clashing. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 12/29
Loop Analysis - the idea The idea behind the new treatment of loops is that we systematically: 1. Calculate the update of the loop body and abstract over the value of the loop variable, {a[I] := I} 2. calculate the range of the loop variable, [0, a.length - 1] 3. make sure that some properties are fulfilled by the loop, For example no clashing. 4. replace the loop by the abstracted update, quantified over by the range of the loop variable. {∀ I ∈ [0 , a.length − 1] . a [ I ] := I, i := a.length } 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 13/29
Loop Analysis - calculating the update When calculating the abstract update for the loop body, there are mainly two ways to go: ⊲ We can create a program analysis that calculates all assignments that are made. Pros: could be tailor made for specific purposes like checking for clashes. Cons: much implementation work, can already be done by KeY. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 14/29
Loop Analysis - calculating the update When calculating the abstract update for the loop body, there are mainly two ways to go: ⊲ We can create a program analysis that calculates all assignments that are made. Pros: could be tailor made for specific purposes like checking for clashes. Cons: much implementation work, can already be done by KeY. ⊲ We can also let KeY compute the update. Pros: little implementation work, can check additional properties. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 15/29
Loop Analysis - soundness properties Observation: What we want to do is quite similar to loop vectorization and parallelization. Instead of executing the loop in a sequential order we execute it in parallel. This can only be done when some properties are fulfilled: ⊲ The loop variable is monotonically increasing/decreasing. (The order of the updates must be clear.) 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 16/29
Loop Analysis - soundness properties Observation: What we want to do is quite similar to loop vectorization and parallelization. Instead of executing the loop in a sequential order we execute it in parallel. This can only be done when some properties are fulfilled: ⊲ The loop variable is monotonically increasing/decreasing. (The order of the updates must be clear.) ⊲ The loop condition is of the form, i op e , where the value of e is not modified by the loop body. (We need to be able to calculate the range of the loop variable.) 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 17/29
Loop Analysis - soundness properties Observation: What we want to do is quite similar to loop vectorization and parallelization. Instead of executing the loop in a sequential order we execute it in parallel. This can only be done when some properties are fulfilled: ⊲ The loop variable is monotonically increasing/decreasing. (The order of the updates must be clear.) ⊲ The loop condition is of the form, i op e , where the value of e is not modified by the loop body. (We need to be able to calculate the range of the loop variable.) ⊲ The loop body does not terminate the loop by executing a break , raising an exception or something similar. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 18/29
Loop Analysis - soundness properties Observation: What we want to do is quite similar to loop vectorization and parallelization. Instead of executing the loop in a sequential order we execute it in parallel. This can only be done when some properties are fulfilled: ⊲ The loop variable is monotonically increasing/decreasing. (The order of the updates must be clear.) ⊲ The loop condition is of the form, i op e , where the value of e is not modified by the loop body. (We need to be able to calculate the range of the loop variable.) ⊲ The loop body does not terminate the loop by executing a break , raising an exception or something similar. ⊲ There is no dependence between the loop iterations. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 19/29
Loop Analysis - soundness properties There are mainly two different kinds of dependencies: for(int i = 0; i <= 10; i++) s : a[i] = a[i - 1]; s v - the statement s where the loop variable has the value v . ⊲ Data dependence A statement s k writes to a location that is read by a statement s l . If k < l , ( a[i] = a[i - 1] ), we cannot execute the loop in parallel. If k > l , ( a[i] = a[i + 1] ), we execute it in parallel and replace a on the RHS with an array containing the original values of a . 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 20/29
Loop Analysis - soundness properties There are mainly two different kinds of dependencies: ⊲ Output dependence A statement s k writes to a location that is overwritten by a statement s l . Both the cases where k > l and l < k , ( a = f(i) ), can be handled by using a last-win clash semantics for the constructed quantified updates. We must only make sure that the updates comes in the right order. 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 21/29
Loop Analysis - benefits of KeY Traditionally, in the field of loop vectorization and parallelization, the test for dependence gives just a boolean answer. If some part of the program is unknown, it must approximate and say that there is a dependence. We, on the other hand, have a theorem prover backing us up! 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 22/29
Loop Analysis - benefits of KeY Traditionally, in the field of loop vectorization and parallelization, the test for dependence gives just a boolean answer. If some part of the program is unknown, it must approximate and say that there is a dependence. We, on the other hand, have a theorem prover backing us up! Consider for example: for(i = 0; i <= 10; i = i + 1) a[i] = b[i + c]; 4th KeY Workshop - L¨ okeberg June 9th, 2005 – p. 23/29
Recommend
More recommend
